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IN THE CLAIMS 

1. (Currently amended) A method of constructing one or more message parsing rules in 
accordance with a user and a machine, comprising the steps of: 

obtaining message data representing past messages, wherein the past messages contain 
management information for at l e ast on e of a network, an application, and a system being analyzed; 

CUlU 

establishing an appropriate rule template for a message structure by scanning the message 
data, building a message skeleton, comparing previously generated rule templates to the message 
skeleton, providing potential rule template matches to the user for validation and choice of a selected 
rule template, determining whether the selected rule template contains enough information to 
identify individual messages, building a rule template through an iterative process between the user 
and the machine based on user selection of at least a portion of the message and designating the built 
rule template as a template to be used in the construction of one or more message parsing rules, when 
the selected rule template does not contain enough information, and designating the selected rule 
template as a template to be used in the construction of one or more message parsing rules: and 

generating one or more message parsing rules by a process based on the obtained message 
data date; and the template to be used in the construction of one or more message parsing rules, and 
defining positive and negative examples in an unparsable message by the user, learning and creating 
possible rules covering positive examples at the machine, and adding a newly created rule to the one 
or more message parsing rules at l e a s t on e of one or mor e e xisting rul e t e mplat e s and us e r s e l e ction 
and cla ss ification of at l e a s t a portion of a moooago , wherein the one or more parsing rules are 
storable for access by a rule-based parsing system. 

2. (Cancelled) 

3. (Original) The method of claim 2, wherein the message data is obtained by at least one of: 
(i) reading past message data &om one or more messages logs; and (ii) one of the network, the 
application and the system pointing to message data in existing data storage. 
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4. (Original) The method of claim 1, wherein the rule-based parsing system comprises a 
message adaptation system. 

5. (Original) The method of claim 1, further comprising the step of establishing a message 
structure prior to the generating step. 

6. (Canceled) 

7. (Canceled) 

8. (Currently amended) The method of claim ? t, wherein the iterative process further 
comprises demonstrative classification of the selected portion as one of a positive example and a 
negative example. 

9. (Currently amended) The method of claim 6 \, wherein the message skeleton comprises 
information relating to one or more of a message start, a message end, and a separator between 
fields. 

10. (Original) The method of claim 1 , wherein classification comprises user demonstration 
of at least one of a positive example and a negative example. 

1 1 . (Original) The method of claim 1 0, wherein classification fiirther comprises the steps of: 
the machine parsing message data sequentially until an unparseable message is encountered; 
the machine displaying the unparseable message to the user; 

the user selecting at least a portion of the unparseable message and marking the selected 
portion as one of a positive example and a negative example; and 

the machine learning based on the example and creating one or more candidate rules. 
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12. (Original) The method of claim 1 1 , further comprising the step of the machine revising 
the one or more candidate rules based on feedback from the user. 

13. (Original) The method of claim 1, wherein each of the one or more generated parsing 
rules comprises a regular expression of a portion of a message. 

14. (Original) The method of claim 1, wherein each of the one or more generated parsing 
rules comprises a transformation rule of a portion of a message. 

15. (Original) The method of claim 14, wherein the transformation rule comprises a string 
constant. 

16. (Original) The method of claim 14, wherein the transformation rule comprises a 
permutation of one or more input tokens. 

17. (Currently amended) Apparatus for constructing one or more message parsing rules, 
comprising: 

a memory; and 

at least one machine-based processor coupled to the memory and operative to: (i) obtain 
message data representing past messages, wherein the past messages contain management 
information for at l e ast on e of a network, an application, and a system being analyzed; and (ii) 
establish an appropriate rule template for a message structure by scanning the message data, building 
a message skeleton, comparing previously generated rule templates to the message skeleton, 
providing potential rule template matches to the user for validation and choice of a selected rule 
template, determining whether the selected rule template contains enough information to identify 
individual messages, building a rule template through an iterative process between the user and the 
machine based on user selection of at least a portion of the message and designating the built rule 
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template as a template to be used in the construction of one or more message parsing rules, when the 
selected rule template does not contain enough information, and designating the selected rule 
template as a template to be used in the construction of one or more message parsing rules: and (iii) 
generate one or more message pairing rules by a process based on the obtained message data data; 
and the template to be used in the construction of one or more message parsing rules, and defining 
positive and negative examples in an unparsable message by the user, learning and creating possible 
rules covering positive examples at the machine, and adding a newly created rule to the one or more 
message parsing rules at l e ast on e of one or mor e e xisting rulo tomplatoo and us e r s e l e ction and 
classification of at l e ast a portion of a m e ssag e, wherein the one or more parsing rules are storable for 
access by a rule-based parsing system. 

1 8. (Original) The ^paratus of claim 1 7, wherein the rule-based parsing system comprises a 
message adaptation system. 

19. (Canceled) 

20. (Canceled) 

21. (Original) The apparatus of claim 17, wherein classification comprises user 
demonstration of at least one of a positive example and a negative example. 

22. (Previously presented) The apparatus of claim 21, wherein classification further 
comprises operations of: 

the at least one machine-based processor parsing message data sequentially until an 
unparseable message is encoimtered; 

the at least one machine-based processor displaying the unparseable message to a user; 

the user selecting at least a portion of the unparseable message and marking the selected 
portion as one of a positive example and a negative example; and 
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the at least one machine-based processor learning based on the example and creating one or 
more candidate rules. 

23. (Currently amended) An article of manufacture for constructing one or more message 
parsing rules in accordance with a user and a machine, comprising a machine readable storage 
medium containing one or more programs which when executed implement the steps of: 

obtaining message data representing past messages, wherein the past messages contain 
management information for at l e ast on e of a network, an application, and a system being analyzed; 

establishing an appropriate rule template for a message structure by scanning the message 
data, building a message skeleton, comparing previously generated rule templates to the message 
skeleton, providing potential rule template matches to the user for validation and choice of a selected 
rule template, determining whether the selected rule template contains enough information to 
identify individual messages, building a rule template through an iterative process between the user 
and the machine based on user selection of at least a portion of the message and designating the built 
rule template as a template to be used in the construction of one or more message parsing rules, when 
the selected rule template does not contain enough information, and designating the selected rule 
template as a template to be used in the construction of one or more message parsing rules: and 

generating one or more message parsing rules by a process based on the obtained message 
data datftr and the template to be used in the construction of one or more message parsing rules, and 
defining positive and negative examples in an unparsable message bv the user, learning and creating 
possible rules covering positive examples at the machine, and adding a newly created rule to the one 
or more message parsing rules at least one of on e or more existing rule t e mplat e s and uaor Golootion 
and ologgificQtion of at loaat a portion of a m e ssa ge, wherein the one or more parsing rules are 
storable for access by a rule-based parsing system. 
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